vCenter 'Add Permission' fails to populate Entra ID groups

Products

• VMware vCenter Server

Issue/Introduction

• When trying to search Entra ID Groups under permissions section of vCenter the groups are not listed.
  
• Provisioning works fine for the Entra ID Users and they are able to login successfully.
• Logs from /var/log/vmware/sso/ssoAdminServer.log of the vCenter have below errors:
  yyyy-mm-dd ERROR ssoAdminServer[325:pool-2-thread-9] [OpId=c7701###############################] [com.vmware.vcenter.tokenservice.jit.ForeignTrustIdentityProvider] User <MASKED USER> not found, return empty groups information for JIT users

Environment

VMware vCenter Server 8.X

Cause

The issue is caused due to two missing configurations required on Entra ID:

• Entra ID sent the groups without a domain tag, vCenter accepted the SCIM payload but orphaned the groups in its database, making them invisible in the UI's domain dropdown.
• Without Group claim, vCenter’s Just-In-Time (JIT) login fallback couldn't read a user's group memberships from their authentication token.

Resolution

To resolve the issue where Entra ID groups fail to populate in the vCenter permissions UI, administrators must configure explicit SCIM attribute mappings and ensure group claims are passed in the authentication token.

• Configure SCIM Group Mapping in the Enterprise Application: Tag groups with the appropriate vCenter domain.
  
  

  1. Navigate to the Entra ID Enterprise Application configured for vCenter provisioning.

  2. Access the provisioning mappings and add a new custom attribute mapping.

  3. Set the mapping type to Constant and enter your specific vCenter domain value.

  4. Set the target attribute to exactly urn:ietf:params:scim:schemas:extension:ws1b:2.0:Group:domain.

  5. Save the provisioning configuration.
     
     
     
     

• Add the Groups Claim to the App Registration: Enable vCenter to dynamically read memberships during login.
  
  

  1. Navigate to the Entra ID App Registration associated with your vCenter identity provider setup.

  2. Select Token Configuration from the left-hand menu.

  3. Add a groups claim to the token (typically selecting security groups or all groups depending on your organizational requirements).

  4. Save the configuration to ensure the token passes group membership arrays to vCenter upon user authentication.
     
     

• Execute On-Demand Sync and Assign in vCenter: Pushes changes and completes the role assignment.
  
  

  1. Return to the vCenter Enterprise Application in Entra ID.

  2. Execute a Provision on demand sync for the required group to immediately push the updated domain attributes to vCenter.

  3. Log in to the vCenter Server web client.

  4. Navigate to the Add Permission section (e.g., under Global Permissions or specific object permissions).

  5. Perform an exact string search for the Entra ID group name; the group will now resolve and allow you to assign the appropriate vCenter role.

Additional Information

Configuring Microsoft Entra ID for vCenter Server